Vulnerability identifier: #VU90336

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26665

CWE-ID: CWE-125

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the iptunnel_pmtud_build_icmpv6() function in net/ipv4/ip_tunnel_core.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/e77bf828f1ca1c47fcff58bdc26b60a9d3dfbe1d
http://git.kernel.org/stable/c/d964dd1bc1452594b4207d9229c157d9386e5d8a
http://git.kernel.org/stable/c/e37cde7a5716466ff2a76f7f27f0a29b05b9a732
http://git.kernel.org/stable/c/510c869ffa4068c5f19ff4df51d1e2f3a30aaac1
http://git.kernel.org/stable/c/7dc9feb8b1705cf00de20563b6bc4831f4c99dab
http://git.kernel.org/stable/c/d75abeec401f8c86b470e7028a13fcdc87e5dd06

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.